GHSA-5FPJ-28RV-84R7 Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Summary Budibase automation steps outgoing webhook, Zapier, n8n, Slack, Discord, Make.com make server-side HTTP requests to user-provided URLs using node-fetch directly, completely bypassing the IP blacklist protection that exists in the REST API integration. Additionally, the REST API blacklist...

GO-2025-3522 vulnerabilities

Vulnerabilities for packages: rancher-agent, rancher-webhook-fips...

GO-2024-2536 vulnerabilities

Vulnerabilities for packages: rancher-webhook...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: cosmo-router-fips, telegraf, cosmo-router, karma-fips, fluxcd-kustomize-mutating-webhook, karma, zitadel, fluxcd-kustomize-mutating-webhook-fips...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: cosmo-router-fips, telegraf, cosmo-router, karma-fips, fluxcd-kustomize-mutating-webhook, karma, zitadel, fluxcd-kustomize-mutating-webhook-fips...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: cosmo-router-fips, telegraf, cosmo-router, karma-fips, fluxcd-kustomize-mutating-webhook, karma, zitadel, fluxcd-kustomize-mutating-webhook-fips...

GO-2024-3282 vulnerabilities

Vulnerabilities for packages: cert-manager-webhook-pdns-fips, step-issuer-fips, step-issuer, cert-manager-istio-csr, cert-manager-webhook-pdns, aws-privateca-issuer-fips, aws-privateca-issuer, cert-exporter, cert-manager-cmctl, cert-manager-cmctl-fips, cert-exporter-fips...

GO-2024-2428 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

GO-2026-5774 vulnerabilities

Vulnerabilities for packages: telegraf, karma, fluxcd-kustomize-mutating-webhook...

GO-2026-5777 vulnerabilities

Vulnerabilities for packages: telegraf, karma, fluxcd-kustomize-mutating-webhook...

GO-2026-5775 vulnerabilities

Vulnerabilities for packages: telegraf, karma, fluxcd-kustomize-mutating-webhook...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, kubernetes-dns-node-cache, kubernetes-csi-driver-hostpath, rancher-fleet, vcluster, argocd-image-updater, kubernetes-csi-driver-nfs, nodetaint, yunikorn-k8shim, ip-masq-agent, aws-efs-csi-driver, argo-rollouts, emissary, kapp, kubernetes,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: cert-exporter, conftest, actions-runner-controller, crossplane-provider-aws-ec2, crossplane-provider-aws-memorydb, grafana-alloy, rancher-fleet, flyte, sftpgo-plugin-eventstore, node-problem-detector, stakater-reloader, istio, haproxy-ingress, kubescape, litefs,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: amass, cosign, conftest, docker-credential-ecr-login, actions-runner-controller, crossplane-provider-aws-ec2, nerdctl, opensearch-k8s-operator, stakater-reloader, gitleaks, swagger, litefs, juicefs, k3s, bank-vaults, calico, kuma,...

EUVD-2026-58502

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTEQUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to inject SQL payloads that execute with builder-configured database credentials,...

PT-2026-72128

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description An Insecure Direct Object Reference IDOR exists where a repository administrator can access notification configurations of other repositories by knowing or guessing the Universally Uniqu...

VulnCheck KEV: CVE-2026-45298

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, in a default dozzle deploy the documented quickstart, no DOZZLEAUTHPROVIDER set, POST /api/notifications/test-webhook is reachable without authentication and forwards an attacker-controlled URL into a WebhookDispatcher that...

PT-2026-72130

Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A flaw exists in the Stripe billing webhook handler. An unauthenticated attacker can forge billing events by sending crafted JSON requests to the /webhooks/stripe endpoint. The system...

CVE-2026-73840

OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhookhandler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket...